ZXUniPOS NDS-LTE CVE-2026-49000

Exploitation requires network access to a ZXUniPOS NDS-LTE instance on an affected build (V24.40.40 / V24.30.40CP02 or earlier) with no authentication (PR:N) and no user interaction (UI:N). The limiting factor is the High attack complexity (AC:H): the attacker must defeat the insecure cryptographic scheme - for example by obtaining ciphertext to decrypt, leveraging a hard-coded/static key, or breaking a weak algorithm - which depends on conditions outside the attacker's direct control rather than a single deterministic request. Realistic risk is therefore bounded by whether the vulnerable service and its protected data are network-exposed and by the attacker's ability to satisfy those cryptographic preconditions; the exact feature/config triggering the weak scheme is not detailed in the available description.

Signals point to a real but lower-priority issue. CVSS is 7.0 (High) driven mainly by network reach, no required privileges (PR:N), and high confidentiality impact (C:H), but attack complexity is High (AC:H), meaning successful exploitation depends on conditions an attacker cannot fully control - consistent with crypto attacks that require intercepting traffic, specific timing, or computational effort. EPSS is extremely low (0.02%, 7th percentile), the vulnerability is not in CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of a high CVSS confidentiality score with very low EPSS and AC:H suggests this is a credible weakness worth patching on a normal cycle rather than an emergency. Note one tension: the description vaguely references both 'data leakage or tampering' while the CVSS shows C:H but only I:L - verify with the vendor advisory whether integrity/tampering is a meaningful real-world impact or just boilerplate.

An attacker with network access to an exposed ZXUniPOS NDS-LTE instance captures or requests data protected by the product's password/encryption scheme, then exploits the weak algorithm or hard-coded key to decrypt sensitive information without any credentials. The AV:N/PR:N vector makes the data network-reachable, but AC:H means the attacker must satisfy specific conditions (e.g., obtaining ciphertext, knowing the static key, or overcoming a partially effective cipher). No public exploit is identified at time of analysis.